I was trying to figure out the discrepancy in why a SWQL query returned more GlobalProtect clients than the SNMP value returned by the firewall. In performing the query it appears as if sometime in June of last year a number of entries got "stuck" in Orion. They show as STATUS=1, meaning active VPN connections. I can construct a SWQL query to identify these entries but I have struggled to figure out how to covert that into a Remove-SWISObject command. The appropriate URI eludes me.
Here is the code I am using so far:
Import-Module SwisPowerShell
# Add-PSSnapin SwisSnapin
$swis = Connect-Swis -hostname -Trusted
#Get-SwisData $swis $Select1
$TEST = Get-SwisData $swis "SELECT Domain, Username, ConnectTime, DisconnectTime, Status, Lifetime, ComputerName, VpnType, TunnelType, VirtualIp, PublicIp, DetailsUrl, DisplayName, Id, RelatedFirewall, DAYDIFF(ConnectTime,GETDATE()) AS HowLong
FROM Cortex.Orion.NetMan.Firewalls.RemoteAccess
WHERE (TunnelTYpe = 'IPSEC' OR TunnelType = 'SSL' ) AND (DAYDIFF(ConnectTime,GETDATE()) = 258) Order BY HowLong DESC"
$TEST | Out-GridView -Title 'Bad Entries' -PassThru
The results look like this:
What I need help with is how to get the right SWIS URI so that I can delete these entries. I tried several combinations, no success.
